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DETAILED ACTION 



1. 



This Office Action is responsive to the following: Amendment filed on 9 June 2006. 



Response to Amendment 



2. 



Claims 1-27 are pending. Claims 1, 9, and 16 are independent. 



3. 



Claims 2-6, 9-14, 16-21 and 23 have been amended. 



4. 



No claims have been cancelled. 



5. No claims have been added. 

Drawings 

6. As per the objection to the Drawings, Applicant's Amendment has been acknowledged. 
Accordingly, the objection has been withdrawn. 

Claim Rejections - 35 USC§ 112 

7. As per the rejections of claims 1-27 under 35 U.S.C § 112, Applicant's Amendment has been 
acknowledged. Accordingly, the rejections have been withdrawn. 

Claim Rejections - 35 USC§ 101 

8. As per the rejections of claims 9-15 under 35 U.S.C § 112, Applicant's Argument has been 
acknowledged and is persuasive. Accordingly, the rejections have been withdrawn. 

Claim Rejections - 35 USC§ 102 

9. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis 
for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 
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(b) the invention was patented or described in a printed publication in this or a foreign country or in public use 
or on sale in this country, more than one year prior to the date of application for patent in the United States. 

10. Claims 1-3, 6, 8-11, 14, 16-18, and 21 are rejected under 35 U.S.C. 102(b) as being 
anticipated by Pisello et al (U.S. Patent No. 5,495,607, hereinafter referred to PISELLO), filed on 
November 15, 1993, and issued on February 27, 1996. 

11. As per independent claim 1, 9 and 16, PISELLO teaches: 

A computer implemented method for gleaning file attributes indepe ndently of file format, 
the method comprising the steps of: 

A non-application specific file attribute manager receiving a plurality of files in a 
plurality of formats {See PISELLO, col. 13, lines 14-19, wherein this reads over "a 
domain-wide status-monitor . . . periodically scan[s]"}; 

The file attribute manager scanning the plurality of received files in the plurality 
of formats {See PISELLO, col. 13, lines 14-19, wherein this reads over "a domain-wide 
status-monitor . . . periodically scan[s]">; 

The file attribute manager gleaning attributes concerning each of the plurality of 
scanned files in the plurality of formats {See PISELLO, col. 13, lines 48-51, wherein this 
reads over "to collect the file identifying information stored at a given scan time"; and 
col. 15, lines 36-51, wherein this reads over, searchable database fields preferably 
include: . . . FileName;PathName"}; 

The file attribute manager storing gleaned attributes concerning each of the 
plurality of scanned files as records in a database {See PISELLO, col. 13, lines 51-56, 
wherein this reads over "to integrate the collected information into the domain-wide 
virtual catalog"}; and 

The file attribute manager indexing attributes being stored as a r ecord in the 
database concerning a specific file according to contents of that file {See PISELLO, col. 
14, lines 16-19, wherein this reads over "Table 2 which shows an example of what might 
be displayed . . . [from] the domain administrating data/rule base"}. 

12. As per dependent claims 2, 10, and 17, PISELLO teaches: 

A method wherein the specific gleaned attributes concerning a specific file are a 
function of a protocol according to which the file is transmitted {See PISELLO, Table 2, 
wherein this includes the file-server name under the column labeled "File_Source" and 
the sender name under the column labeled "By"}. 

13. As per dependent cla im 3, 11, 18, PISELLO teaches: 

A method wherein the specific gleaned attributes concerning a specific file are a 
function of the format of that file {See PISELLO, col. 15, lines 46-51, wherein this reads 
over "Novell-defined attributes"}. 
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14. As per dependent claims 6, 14, 21, PISELLO teaches: 

A method further comprising the file attribute manager receiving a plurality of 
copies of the same file, and the file attribute manager storing a separate record for each 
received copy of the file, each record being indexed according to the contents of the file, 
such that each record can be accessed by the single index {See PISELLO, Table 2; and 
col. 14, lines 62-64, wherein this reads over "the same file name may appear multiple 
times in the listing of Table 2, even with identical path names (e.g., x Dave.doc')"}. 

15. As per dependent claim 8, PISELLO teaches: 

The method wherein the non-application specific file attribute manager is 
incorporated into a server or a client {See PISELLO, col. 13, lines 14-15, wherein this 
reads over "domain-wide status-monitor and control program is installed in the domain 
administrating server"}. 



Claim Rejections - 35 USC§ 103 

16. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all obviousness 
rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art 
are such that the subject matter as a whole would have been obvious at the time the invention was made to a 
person having ordinary skill in the art to which said subject matter pertains. Patentability shall not be 
negatived by the manner in which the invention was made. 

17. Claims 4, 12, and 19 are rejected under 35 U.S.C. 103(a) as being unpatentable over PISELLO, 
in view of Fischer (U.S. Patent No. 5,694, 569, hereinafter referred to as FISCHER), filed on June 5, 1995, 
and issued on December 2, 1997. 

PISELLO teaches the limitations of claims 1-3, 6, 8-11, 14, 16-18, and 21 for the reasons stated 

above. 

PISELL 0 differs from the claimed invention in that PISELLO fails to disclose a method further 
comprising the file attribute manager indexing attributes being stored by using a secure hash of the 
contents of that file (claims 4, 12, and 19). 

18. As per dependent claim 4, 12, and 19, PISELLO, in combination with FISCHER, discloses a 
method further comprising the file attribute manager indexing attributes being stored as a record in the 
database concerning a specific file according to a secure hash of the contents of that file {See FISCHER, 
col. 1, lines 40-50, wherein this reads over Tile integrity may be protected by taking a one-way hash over 
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the contents of the file. By implementing and checking a currently computed hash value, with a 
previously stored hash value"}. 

The combination of inventions disclosed in PISELLO and FISCHER would disclose a method 
wherein the file attribute manager would index attributes in a database according to a secure hash, by 
using a secure hash algorithm (SHA), of the contents of that file. Therefore, it would have been obvious 
to one of ordinary skill in the art at the time the invention was made to modify the above invention 
suggested by PISELLO by combining it with the invention disclosed by FISCHER. 

One of ordinary skill in the art would have been motivated to do this modification so that the 
records may be indexed securely and subsequently retrieved by a blocking system. 

19. Claims 5, 13, and 20 are rejected under 35 U.S.C. 103(a) as being unpatentable over PISELLO, 
in view of Baker (USPGPUB No. 2003/0233352, hereinafter referred to as BAKER), filed on March 19, 
2003, claiming priority to March 21, 2002, and published on December 18, 2003. 

PISELLO teaches the limitations of claims 1-3, 6, 8-11, 14, 16-18, and 21 for the reasons stated 

above. 

PISELL O differs from the claimed invention in that PISELLO fails to disclose a method 
further comprising the file attribute manager indexing attributes according to a cyclical 
redundancy check of the contents of that file (claims 5, 13, and 20). 

20. As per dependent claims 5, 13, and 20, PISELLO, in combination with BAKER, 
discloses a method further comprising the file attribute manager indexing attributes being stored 
as a record in the database concerning a specific file according to a cyclical redundancy check of 
the contents of that file {See BAKER, Para. 0008, wherein this reads over u [t]he controller may 
be further programmed ... to determine a cyclical redundancy check of the file"}. 

The combination of inventions disclosed in PISELLO and BAKER would disclose a method wherein 
the file attribute manager would index attributes in a database according to a cyclical redundancy check 
of the contents of that file. Therefore, it would have been obvious to one of ordinary skill in the art at 
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the time the invention was made to modify the above invention suggested by PISELLO by combining it 
with the invention disclosed by BAKER. 

One of ordinary skill in the art would have been motivated to do this modification so that the 
records may be indexed securely and subsequently retrieved by a blocking system. 

21. Claims 7, 15, and 22 are rejected under 35 U.S.C. 103(a) as being unpatentable over PISELLO, 
in view of Chino et al (USPGPUB 2002/0046207), filed on June 25, 2001, and published on April 18, 2002. 

PISELLO differs from the claimed invention in that PISELLO fails to disclose a method which 
deletes records from the database after the records have been stored for a specific period of time (claims 
7, 15, and 22). 

22. As per dependent claims 7, 15, and 22, PISELLO, in combination with CHINO, discloses a 
method further comprising of deleting records from the database after the records have been stored for a 
specific period of time {See CHINO, Para. 0060, wherein this reads over "location information collector 
determines whether a predetermined time , e.g. two hours, has passed wince the record of the current 
location registered in the respective tables of the location information storage was collected, and 
sequentially deletes those records with a predetermined time elapsed"}. 

The combination of inventions disclosed in PISELLO and CHINO would disclose a method 
comprising of deleting records with a predetermined time elapsed. Therefore, it would have been 
obvious to one of ordinary skill in the art at the time the invention was made to modify the above 
invention suggested by PISELLO by combining it with the invention disclosed by CHINO. 

One of ordinary skill in the art would have been motivated to do this modification so that 
the database is kept current and free of obsolete records. 

23. Claims 23-27 are rejected under 35 U.S.C. 103(a) as being unpatentable over PISELLO, in view 
of Touboul (U.S. Patent No. 6,092,194, hereinafter referred to as TOUBOUL), filed on November 6, 1997, 
and issued on July 18, 2000. 

PISELLO teaches the limitations of claims 1-3, 6, 8-11, 14, 16-18, and 21 for the reasons stated 

above. 
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PISELLO differs from the claimed invention in that PISELLO fails to disclose a method for 
retrieving at least one stored record concerning the file, and thereafter determining a status concerning 
the file (claim 23). 

PISELLO differs from the claimed invention in that PISELLO fails to disclose a method for blocking 
malicious files (claim 24). 

PISELLO differs from the claimed invention in that PISELLO fails to disclose a method for allowing 
legitimate files (claim 25). 

24. As per dependent claim 23, PISELLO, in combination with TOUBOUL, discloses the following: 

A method further comprising: 

Examining a file, the file having been processed by the non-application specific 
file attribute manager {See TOUBOUL, col. 7, lines 46-59, wherein this reads over "[t]he 
ID generator in step 604 generates a Downloadable ID identifying the received 
Downloadable"}; 

Retrieving at least one stored record concerning the file from the database {See 
TOUBOUL, col. 7, lines 60-64, wherein this reads over Tirst comparator in step 608 
examines the lists of Downloadables to allow or to block per administrative override"}; 

Analyzing gleaned attributes concerning the file, the gleaned attributes having 
been retrieved from at least one record concerning the file in the database {See 
TOUBOUL, col. 8, lines 10-14, wherein this reads over "the URL comparator in step 616 
compares the URL embodied in the incoming Downloadable against the URLs of the URL 
rules bases"} ; and 

Responsive to analyzing the gleaned attributes, determining a status concerning 
the file {See TOUBOUL, col. 8, line 63 - col. 9, line 19, wherein this reads over "receiving 
the results from the first comparator, from the ACL comparator, from the certificate 
comparator, and from the URL comparator" and "the policy selector in step 664 indicates 
that the Downloadable should not pass"}. 

The combination of inventions disclosed in PISELLO and TOUBOUL would disclose a method 
comprising of examining a file, analyzing the gleaned attributes concerning the file with records retrieved 
from the database (e.g. "certificate" and "URL" details), and determining the status of the file (i.e. to 
allow or block the file). Therefore, it would have been obvious to one of ordinary skill in the art at the 
time the invention was made to modify the above invention suggested by PISELLO by combining it with 
the invention disclosed by TOUBOUL. 
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One of ordinary skill in the art would have been motivated to do this modification so malicious or 
illegitimate files are blocked from entering the computer, from executing, and from performing certain 
functions while executing. 

25. As per dependent claim 24, PISELLO, in combination with TOUBOUL, discloses a method of 
blocking a file upon the determination that the received file is malicious {See TOUBOUL, col. 9, lines 13- 
19, wherein this reads over "the policy selector in step 664 indicates that the Downloadable should not 
pass . . . [and] informs the user the user that the incoming Downloadable has been blocked"}. 

The combination of inventions disclosed in PISELLO and TOUBOUL would disclose a method 
comprising of blocking the file (i.e. or not allowing passage) upon the determination that the received file 
is malicious (e.g. where the policy selector indicates whether or not a Downloadable should pass to the 
user). Therefore, it would have been obvious to one of ordinary skill in the art at the time the invention 
was made to modify the above invention suggested by PISELLO by combining it with the invention 
disclosed by TOUBOUL. 

One of ordinary skill in the art would have been motivated to do this modification so malicious or 
illegitimate files are blocked from entering the computer, from executing, and from performing certain 
functions while executing. 

26. As per dependent claim 25, PISELLO, in combination with TOUBOUL, discloses a method of 
not blocking the file upon the determination that the received file is legitimate {See TOUBOUL, col. 9, 
lines 1-19, wherein this reads over "the policy selector may indicate that the logical engine pass the 
Downloadable if it passes one of the tests"}. 

The combination of inventions disclosed in PISELLO and TOUBOUL would disclose a method 

comprising of allowing the file (e.g. "Downloadable") upon the determination that the received file is 

> 

legitimate (e.g. where the policy selector indicates that the Downloadable has passed a certain test). 
Therefore, it would have been obvious to one of ordinary skill in the art at the time the invention was 
made to modify the above invention suggested by PISELLO by combining it with the invention disclosed 
by TOUBOUL. 
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One of ordinary skill in the art would have been motivated to do this modification so non- 
malicious or legitimate files are allowed to enter the computer, to execute, and to performing certain 
functions while executing. 

27. As per dependent claim 26, PISELLO, in combination with TOUBOUL, discloses a method for 
applying a rule specifying how to use gleaned file attributes to process the file {See TOUBOUL, col. 8, 
lines 7-13, wherein this reads over "the URL comparator in step 616 compares the URL embodied in the 
incoming Downloadable against the URLs of the URL rule bases"}. 

The combination of inventions disclosed in PISELLO and TOUBOUL would disclose a method 
comprising for applying a rule specifying how to use gleaned file attributes to process a file. Therefore, it 
would have been obvious to one of ordinary skill in the art at the time the invention was made to modify 
the above invention suggested by PISELLO by combining it with the invention disclosed by TOUBOUL. 

One of ordinary skill in the art would have been motivated to do this modification in order to 
determine the maliciousness or legitimacy of a file by analyzing and processing the gleaned attributes 
according to a set rule. 

28. As per dependent claim 27, PISELLO, in combination with TOUBOUL, discloses a method for 
determining a rule to apply specifying how to use gleaned file attributes to process the file {See 
TOUBOUL, Figure 6, wherein if "URL comparison" is not required, the method proceeds to the "ACL 
comparison," which if not required goes to the "TCL comparison"}. 

The combination of inventions disclosed in PISELLO and TOUBOUL would disclose a method 
comprising of determining at least one of a plurality of rules to apply to a file. Therefore, it would have 
been obvious to one of ordinary skill in the art at the time the invention was made to modify the above 
invention suggested by PISELLO by combining it with the invention disclosed by TOUBOUL. 
One of ordinary skill in the art would have been motivated to do this modification so that upon the failure 
or passage of a file in a rule, further gleaned attributes may be checked to determine the maliciousness 
and legitimacy of a file. 
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Response to Arguments 

29. As per claims 1,9, and 16, Applicant's arguments filed 9 June 2006 have been fully considered 
but they are not persuasive. 

Applicants Arguments: 

Applicant's Argument states the following: 

a. On pages 12-14 of the Amendment, that "Pisello does not receive a plurality of files in a 
plurality of formats" and thus fails to disclose or suggest the claimed invention. 
Response to Arguments: 

Regarding Applicant's argument that Pisello fails to disclose or suggest the method of "receiving a 
plurality of files in a plurality of formats," it is noted that Pisello, in col. 13, lines 14-55, allows a domain- 
wide status-monitor and control program to "interrogate each DAS-managed file-server regarding the 
contents of each local catalog," wherein the "catalog" interrogated would constitute and read on the "file" 
received by the attribute manager in the claimed invention. Therefore, the catalog would in-fact contain 
file attributes such as those disclosed in Tables 1 and 2 of Pisello. Furthermore, the DAS-managed file- 
server would receive a "plurality of files in a plurality of formats" since the file server control program 
may scan and receive a local catalog from each of the DAS-managed file-servers. Wherein the catalog 
(i.e. the "file") contains the aforementioned attributes, it would not "be impossible for the domain-wide 
status-monitor to glean file attributes from the received files" (See Arguments, page 14) since the DAS- 
managed file-server and control program could receive the "catalog" and said attributes collected and 
stored into a "domain-wide virtual catalog so that each user file stored in the domain during a given 
scan-period can be identified by . . . relevant attributes" (See Pisello, col. 13, lines 14-55). 

For the aforementioned reasons above, the rejection of claims 1, 9, and 16 are sustained under 
35 U.S.C. § 102(b). 

30. As per claims 2-3, 6, 8, 10-11, 14, 17-18 and 21, Applicant has not asserted any specific 
arguments in response to the rejections of the claims. Therefore, the rejections of claims 2-3, 6, 8, 10- 
11, 14, 17-18 and 21 are sustained because Applicant has not traversed the rejections nor presented any 
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arguments for overcoming the rejections contained in the prior Office Action, dated 7 March 2006. 
Furthermore, by virtue of dependency, the rejections of Claims 2-3, 6, 8, 10-11, 14, 17-18 and 21 are 
sustained under 35 U.S.C. § 102(b) for the reasons stated above in relation to Claims 1, 9, and 16. 
31. As per claims 4, 5, 7, 12, 13, 15, 19, 20, and 22-27, Applicant has not asserted any specific 
arguments in response to the rejections of the claims. Therefore, the rejections of claims 4, 5, 7, 12, 13, 
15, 19, 20, and 22-27 are sustained because Applicant has not traversed the rejections nor presented any 
arguments for overcoming the rejections contained in the prior Office Action, dated 7 March 2006. 
Furthermore, by virtue of dependency, the rejections of Claims 4, 5, 7, 12, 13, 15, 19, 20, and 22-27 are 
sustained under 35 U.S.C. § 103(a) for the reasons stated above in relation to Claims 1, 9, and 16. 



Conclusion 

32. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set 
forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE MONTHS from 
the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date 
of this final action and the advisory action is not mailed until after the end of the THREE-MONTH 
shortened statutory period, then the shortened statutor/ period will expire on the date the advisory 
action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing 
date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX 
MONTHS from the mailing date of this final action. 

33. Any inquiry concerning this communication or earlier communications from the examiner should 
be directed to Paul Kim whose telephone number is (571) 272-2737. The examiner can normally be 
reached on M-F, 9am - 5pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's supervisor, 
Christian Chase can be reached on (571) 272-4190. The fax phone number for the organization where 
this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the Patent Application 
Information Retrieval (PAIR) system. Status information for published applications may be obtained from 
either Private PAIR or Public PAIR. Status information for unpublished applications is available through 
Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 
866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or 
access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

Paul Kim 

Patent Examiner, Art Unit 2161 
Technology Center 2100 




SAM RIMELL 
°RIMARY EXAMINER 



